Denial of Service Vulnerability in RE2JS JavaScript Regular Expression Engine
CVE-2026-116795
7.5HIGH
What is CVE-2026-116795?
RE2JS, a JavaScript port of the RE2 regular expression engine, presents a vulnerability that can result in a denial of service. In versions 2.2.0 through 2.8.7, the use of LOOKBEHINDS with functions like matcher().find() and matcher().replaceAll() leads to inefficient scanning behavior that causes high computational overhead. The design flaw allows attacker-controlled input to monopolize a thread, extending processing time significantly when the engine attempts to process complex regular expressions, particularly in dense matches. This issue has been addressed in RE2JS version 2.8.7.
Affected Version(s)
re2js >= 2.2.0, < 2.8.7